WHAT IS CLAIMED IS: 

1 1 . A method comprising: 

2 reading one or more event data, the one or more event data corresponding to an 

3 event monitored from a system; 

4 for each event datum, compressing the event datum if the event datum is 

5 determined to be compressible; 

6 creating a processed event record, the processed event record conforming to a 

7 record format; and 

8 storing the one or more event data in the processed event record in accordance 

9 with the record format. 

1 2. The method of claim 1 , wherein said creating a processed event record and storing 

2 the one or more event data in the processed event record in accordance with the 

3 record format comprises one of the following: 

4 if one or more of the one or more event data is determined not to be compressible, 

5 then: 

6 creating an uncompressed event record in an uncompressed record format; 

7 and 

8 storing each event datum in an uncompressed format in the uncompressed 

9 event record; 

10 if each of the one or more event data is determined to be compressible, then: 

1 1 creating a compressed event record in a compressed record format; and 

12 storing each event datum in a compressed format in the compressed event 

13 record; and 

14 if one or more of the one or more event data is determined not to be compressible, 

15 then: 
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16 creating a hybrid event record in a hybrid record format; and 

1 7 storing each uncompressed event datum in an uncompressed format in the 

18 hybrid event record, and storing each compressed event datum in a 

1 9 compressed format in the hybrid event record. 

1 3. The method of claim 1, wherein said compressing each event datum comprises 

2 characteristics-based compression. 

1 4. The method of claim 3, wherein the characteristics-based compression comprises 

2 using a selected one of one or more compression algorithms to compress the event 

3 datum, wherein the selected compression algorithm compresses the event datum 

4 in accordance with one or more characteristics of the event datum. 

1 5. The method of claim 4, additionally comprising setting the one or more 

2 compression algorithms. 

1 6. The method of claim 3, wherein the characteristics-based compression algorithm 

2 comprises for at least one of the one or more event data; 

3 generating a hash from a value, the value based, at least in part, on one or more 

4 characteristics of a given event datum of the at least one of the one or 

5 more event data; 

6 mapping the hash to a dictionary index in a dictionary, the index corresponding to 

7 a dictionary entry; and 

8 if the dictionary entry corresponds to the given event datum, then outputting the 

9 dictionary index. 

1 7. The method of claim 6, additionally comprising if the dictionary entry does not 

2 correspond to the given event datum, then outputting the given event datum. 

1 8. A method comprising: 

2 reading one or more processed event records from an event buffer, each processed 

3 event record including one or more processed event data corresponding to 
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4 one or more uncompressed event data; and 

5 generating one or more client uncompressed event data corresponding to the one 

6 or more uncompressed event data, said generating one or more client 

7 uncompressed event data including one of: 

8 decompressing an event datum if the event datum is in a compressed 

9 format; and 

10 outputting an event datum if the event datum is not in a compressed 

1 1 format. 

1 9. The method of claim 8, wherein said decompressing the event datum comprises: 

2 mapping a plurality of bits of the event datum to a dictionary index in a 

3 dictionary, each entry in the address dictionary including a dictionary 

4 index and a corresponding dictionary entry; and 

5 using the dictionary entry to obtain the one or more uncompressed event datum. 

1 10. The method of claim 9, wherein if the event datum is not in a compressed format: 

2 generating a hash value from a compression value, the compression value based, 

3 at least in part, on the event datum; 

4 mapping the hash value to a dictionary index in a dictionary having one or more 

5 entries, each entry corresponding to a hash value and a dictionary entry; 

6 replacing the dictionary entry with the compression value, said replacing 

7 occurring at an entry of the dictionary corresponding to the hash value. 

1 11. An apparatus comprising: 

2 circuitry capable of: 

3 reading one or more event data, the event data corresponding to an event 

4 monitored from a system; 
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5 for each event datum, compressing the event datum if the event datum is 

6 determined to be compressible; 

7 creating a processed event record, the processed event record conforming to a 

8 record format; and 

9 storing the one or more event data in the processed event record in accordance 

1 0 with the record format. 

11 12. The apparatus of claim 1 1, wherein said circuitry is further capable of using 

12 characteristics-based compression on each event datum. 

1 13. The apparatus of claim 12, wherein said circuitry is further capable of using a 

2 selected one of one or more compression algorithms to compress the event datum, 

3 wherein the selected compression algorithm compresses the event datum in 

4 accordance with one or more characteristics of the event datum. 

1 14. The apparatus of claim 13, wherein said circuitry is further capable of setting the 

2 one or more compression algorithms. 

1 15. A system comprising: 

2 circuitry capable of: 

3 reading one or more event data, the event data corresponding to an event 

4 monitored from a system; 

5 for each event datum, compressing the event datum if the event datum is 

6 determined to be compressible; 

7 creating a processed event record, the processed event record conforming 

8 to a record format; and 

9 storing the one or more event data in the processed event record in 
10 accordance with the record format; and 

11 
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1 1 a compiler to read the processed event record. 

1 16. The system of claim 15, wherein said circuitry is further capable of using 

2 characteristics-based compression on each event datum. 

1 17. The system of claim 16, wherein said circuitry is further capable of using a 

2 selected one of one or more compression algorithms to compress the event datum, 

3 wherein the selected compression algorithm compresses the event datum in 

4 accordance with one or more characteristics of the event datum. 

1 18. The system of claim 17, wherein said circuitry is further capable of setting the one 

2 or more compression algorithms. 

1 19. A machine-readable medium having stored thereon instructions, the instructions 

2 when executed by a machine, result in the following: 

3 reading one or more event data, the event data corresponding to an event 

4 monitored from a system; 

5 for each event datum, compressing the event datum if the event datum is 

6 determined to be compressible; 

7 creating a processed event record, the processed event record conforming to a 

8 record format; and 

9 storing the one or more event data in the processed event record in accordance 
1 0 with the record format. 

1 20. The machine-readable medium of claim 19, wherein said instructions, when 

2 executed by the machine, additionally result in the machine using characteristics- 

3 based compression on each event datum. 

1 21. The machine-readable medium of claim 20, wherein said instructions, when 

2 executed by the machine, additionally result in the machine using a selected one 

3 of one or more compression algorithms to compress the event datum, wherein the 

4 selected compression algorithm compresses the event datum in accordance with 
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one or more characteristics of the event datum. 

22. The machine-readable medium of claim 21, wherein said instructions, when 
executed by the machine, additionally result in the machine setting the one or 
more compression algorithms. 
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